Japan

APPI reaches biometric identifiers through the concept of an individual identification code (Art. 2(2)(i)): a code converted to identify a specific individual by a distinguishing physical feature. Cabinet Order Art. 1 enumerates the covered features and names both facial appearance and vocal characteristics expressly, alongside DNA base sequence, iris pattern, gait, and palm or hand vein pattern.

Personal information containing an individual identification code is personal information in itself, without needing to be combined with other data, but it sits outside the Art. 2(3) sensitive personal information category, so its capture does not trigger the Art. 20(2) prior-consent requirement that applies to race, health data, and similar categories; disclosure to a third party instead requires the data subject's consent under the general third-party-provision rule, since data containing an individual identification code is excluded from the opt-out mechanism.

Art. 26(1) requires a business to report to the Personal Information Protection Commission any leak, loss, or damage of personal data that PPC order identifies as likely to harm individual rights and interests, following PPC-set procedure and timing; no duplicate report is needed where an entrusting business has already been notified. The administrative-entity mirror duty sits at Art. 68.

The PPC's own order or rules set the specific report-timing thresholds and the individual-notification trigger; the Art. 26 duty is summarised without that procedural detail.

The Act on the Protection of Personal Information (APPI) is Japan's single comprehensive personal-data statute, covering private businesses (Chapter IV), administrative organs (Chapter V), and independent administrative agencies since the 2021 merger amendment folded the former separate acts into one text. Lawful basis is purpose-of-use notice under Art. 15 plus a general prohibition on wrongful acquisition under Art. 20(1); there is no General Data Protection Regulation (GDPR)-style enumerated legal-basis list.

APPI regulates businesses handling personal information directly rather than a controller and processor split, and Art. 25 imposes supervision duties over any entrusted processor.

Art. 28 requires a data subject's prior consent before a business transfers personal data to a third party in a foreign country, unless the destination country is one the Personal Information Protection Commission (PPC) has recognized as having an equivalent personal-information protection system, or the recipient has established a system that continuously ensures measures equivalent to APPI's own Section 4 duties.

Before seeking consent, the business must disclose the destination country's protection system and the recipient's own measures. This is a real consent-or-adequacy restriction, moderate rather than absent; there is no general data-localization mandate in APPI itself.

The Personal Information Protection Commission (PPC) is Japan's independent supervisory authority, holding recommendation and order powers under Chapter VI. Violating a PPC order under Art. 148(2) or (3) is a criminal offense under Art. 178, punishable for an individual by imprisonment with work for not more than one year or a fine of not more than JPY 1,000,000.

APPI carries no dedicated statutory private right of action; a data subject's civil remedy runs through general tort law under Civil Code Art. 709, outside APPI itself, so enforcement of the statute is PPC-only.

Article 2(4) defines an act of unauthorized computer access as operating a specified computer that carries an access control feature, in a way the feature restricts, by inputting via a telecommunications line another person's identification code associated with that feature, or other information or a command designed to evade the feature.

Article 3 prohibits any person from engaging in such an act; violating it is punished under Article 11 by imprisonment with work for not more than three years or a fine of not more than 1,000,000 yen. The Act also prohibits obtaining, storing, or supplying such an identification code for that purpose, and impersonating an access administrator to solicit one (Arts. 4 through 7), each punished less severely under Articles 12 and 13.

Because every prohibited act requires defeating an access control feature the target computer already carries, reading a public, unauthenticated page that carries no such feature falls outside a plain reading of the Act.

Article 30-4 permits exploiting a copyrighted work, by any method and to the extent considered necessary, whenever the purpose is not to personally enjoy or cause another to enjoy the thoughts or sentiments the work expresses, including reproduction for information analysis such as AI model training, unless doing so would unreasonably prejudice the copyright owner's interests given the work's nature and use and the manner of the exploitation.

The exception's only express limit is whether the exploitation would unreasonably prejudice the copyright owner's interests in light of the work's nature or purpose or the circumstances of the exploitation; official guidance from the Agency for Cultural Affairs treats defeating a technical measure such as robots.txt as one basis for finding that limit reached where the work is a database built and marketed for information analysis.

The exception was inserted by Act No. 30 of 2018 and came into effect 1 January 2019. Exploiting a work outside the scope of this or another statutory exception is copyright infringement under Art. 119(1), punished by imprisonment with work for not more than ten years, a fine of not more than 10,000,000 yen, or both.

A person is a young person (seishonen) under this Act if under 18. Before concluding a mobile phone or PHS internet-connection service contract, the carrier must confirm whether the counterparty is a young person and, if not, whether the actual device user is (Art. 13).

The carrier must then provide the internet connection conditional on use of a youth-harmful-information filtering service whenever the contracting party or device user is a young person, unless the young person's guardian opts out (Art. 15), and a seller of a covered mobile handset must implement filtering-enabled measures on the same conditional basis (Art. 16).

A general (fixed-line) internet connection provider must supply filtering software or a filtering service on request from any user (Art. 17). A manufacturer of an internet-connectable device must build in or otherwise ease the use of filtering software before selling the device (Art. 18), and a developer of software that directly controls such a device's operation must make a best-efforts attempt to the same end (Art. 19). The Act carries no penalty, fine, or administrative-order provision for a violation of any of these duties.

A child under this Act is a person under 18 (Art. 2(1)). An internet dating (opposite sex introduction) service operator must, per National Public Safety Commission rule and in advance, confirm that a person seeking correspondence is not a child before relaying that person's information to another user or letting the two exchange contact details, unless the operator's own prior identity-confirmation procedure already covers that person (Art. 11).

The operator must also display and communicate a notice that children may not use the service (Arts. 9-10) and must notify the National Public Safety Commission before starting the business (Art. 7(1)). The prefectural Public Safety Commission may direct an operator that breaches the Act to correct the breach (Art. 13) and may order a suspension of up to six months, or a closure, for specified further violations (Art. 14).

Violating a suspension or closure order carries imprisonment up to one year, a fine up to JPY 1,000,000, or both (Art. 31). Operating without the required notification, breaching the Art. 9 duty, or violating an Art. 13 or Art. 15(2)(i) instruction carries imprisonment up to six months or a fine up to JPY 1,000,000 (Art. 32).

A false or missing notification under Art. 7 carries a fine up to JPY 300,000 (Art. 34), and a company is fined the same amount as its employee or agent under the dual-liability rule (Art. 35).

Article 32(1) permits quoting and thereby exploiting a work that has already been made public, provided the quotation is consistent with fair practice and stays within a scope justified for the purpose of news reporting, critique, research, or another purpose for which the work is quoted.

This is the general ground under which reproducing a headline or a short extract of third-party journalism could be justified without the rights holder's authorization; it is a fair-practice standard rather than a fixed word or length threshold. A quotation exceeding this scope is copyright infringement, punished under Art. 119(1) by imprisonment with work for not more than ten years, a fine of not more than 10,000,000 yen, or both.